Unu has done a great job again this time. He should make the Kaspersky known to this issue before making the vulnerability public. I think he did so. The site was at risk and so were many users. How these big sites are potentially vulnerable to different attacks!!
Regards, Pradip Unu, who has gained a good deal of attention lately, is known for his vulnerability disclosures that center on SQL Injection. In his latest adventures, he returns to a vendor he has targeted in the past, security software specialist Kaspersky. In February, Unu went public on HackersBlog and disclosed the SQL Injection flaws he had discovered on Kaspersky’s USA portal. The flaws, which led to complete access to users, activation codes, lists of bugs, admins, shopping, etc., were quickly patched, and Kaspersky was quick to point out that, “despite their attempts, the hackers were unable to gain access to restricted information stored on the website. Claims by the hackers responsible for the attack that they had managed to gain access to user data are untrue.” Read more: http://www.thetechherald.com/article.php/200950/4931/Unu-hits-Kaspersky-a-second-time-with-SQL-Injection-disclosure#ixzz0ZZIWR9U7
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/